Linux aws: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string… (CVE-2026-63860)

CVE-2026-63860 concerns a vulnerability in the Linux kernel's RDMA core where attributes evaluated as C-strings were handled using NLA_STRING, which does not enforce the presence of a null terminator. This could cause unsafe string operations such as strcmp on non-null-terminated data. The fix involves preferring NLA_NUL_STRING or switching to nla_strcmp() with adjusted printf format specifiers to ensure safe string handling. The vulnerability affects linux-aws kernel versions prior to 5.15.0-1112.119~20.04.1, 5.15.0-1117.126~20.04.1, 5.15.0-1117.126~20.04.2, 5.15.0-1112.122~20.04.1, and 5.15.0-186.196~20.04.1. The issue has been patched as part of a broader set of Linux kernel security updates.

The vulnerability allows potential memory safety issues due to improper string handling in the RDMA core subsystem of the Linux kernel. This can lead to high impact consequences including confidentiality, integrity, and availability compromises as indicated by the CVSS score of 8.4 with high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

A patch is available for this vulnerability and should be applied by updating the Linux kernel to the fixed versions listed. After updating, a system reboot is required to apply the changes. Note that due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow the vendor's official update instructions and advisories (e.g., Ubuntu Security Notices USN-8574-1 and USN-8575-1) to ensure complete remediation.